DATA PRIVACY CONSENT FORM

Republic Act No. 10173, otherwise known as The Data Privacy Act of 2012 (the "Data Privacy Act), sets out the principles that should be followed when processing Personal Information and Sensitive Personal Information (collectively, "Personal Data") of any kind. One of the ways in which Rockwell Land Corporation and its subsidiaries (“Rockwell”) can take steps to comply with some of these principles is to ask for your consent to process your Personal Data which are related to your assignment.

We maintain certain Personal Data about you as part of our general employee records. Our records may include your name, address and contact details (email address and can be reached numbers), birthday, marital status, gender, nationality, educational background, employment application, history with the company, areas of expertise, details of salary and benefits, bank details, performance appraisals and salary reviews, records relating to holiday and other leave, working time records, medical/health records and history, government-issued identifications (including passport, driver's license, social security number, PhilHealth number, Tax Identification Number), tax records, and other management records related to your employment with Rockwell. We have obtained this data in several ways - directly from you, from third-party service providers and/or otherwise over time through our relationship with you - and may receive and/or retain the same in various forms (whether in writing, electronically, verbally, or otherwise).

We use the Personal Data for a variety of legitimate business purposes, including but not limited to:

• To comply with the laws or legal, regulatory and government and/or agency requirements and obligations, and to perform other processing or disclosure that may be required under law or regulations.
• To allow Rockwell to understand employee and individual consultant profiles, skills, and capabilities necessary for designing and informing decisions for group-wide talent management. Initiatives include, but are not limited to (1) talent management and mobility, (2) performance management, (3) succession management, (4) leadership development, (5) competency management, (6) talent acquisition, etc.;
• To process employee salaries and benefits;
• To perform employee services; execute employee development, communications, health and safety engagement programs, and organizational planning and management;
• To provide assistance in case of emergency, and to account for employees during emergencies and/or crises;
• To enable effective management of HR functions (e.g. scorecard/metrics, risk and compliance reviews) while ensuring compliance with legal, regulatory, and ethical standards;
• To provide insights into the state of our Diversity, Equity, Inclusion and Belonging (DEIB), allow us to customize our strategies, and help us craft initiatives and interventions that will bring the most impact to the organization. Sample efforts may include, but are not limited to, (1) gender equality, (2) inclusion of persons with disabilities, (3) creation of employee resource groups, (4) policy changes, among others;
• To establish data quality standards and a governance structure to ensure accurate, valid, and reliable employee data across Rockwell, its affiliates, and its parent company;
• To collect employee data in a single, secure system and centralize information for accuracy, security, and accessibility, ensuring seamless data management that evolves with business needs;
• To ensure business continuity and employee welfare checks;
• To outsource benefits processing support services, including medical reimbursements and transportation liquidation.
• To include in Rockwell's Integrated Report, reflecting the organization's commitment to employee development, regulatory compliance, and sustainability. It provides transparency on workforce learning, aids in strategic workforce planning, and highlights investments in human capital;
• To track attendance for the following purposes: (1) Annual Integrated Report, (2) assess participation trends and identify high-impact topics, (3) support employee growth and determine engagement by identifying those who actively engage in learning sessions;
• To validate health status and key health data for participation in engagement activities, including clustering of participants according to age group, and to gather profiles of participants for customizing design of engagement activities and logistical preparations;
• To manage security to Rockwell’s premises by granting required access at the workplace for the performance of an individual’s duties and obligations;
• To grant access to Rockwell's IT systems and infrastructure - consistent with IT policies and procedures;
• To process requirements for work purposes, including travel, certification, appointments, and the like;
• To conduct internal investigations in relation to security incidents, disciplinary proceedings, and other analogous circumstances;
• To respond to or address specific complaints, inquiries, or requests; and
• Other similar or related purposes.

As a general rule, we do not and will not share personal data with third parties except as necessary for the proper execution of processes related to a declared purpose, or the use or disclosure is reasonably necessary, required, or authorized by or under law. This means Rockwell may provide personal data to (a) existing and prospective business partners, service providers, and contractors, consistent with the purposes discussed above; (b) affiliates and subsidiaries of Rockwell; and (c) law enforcement and government agencies. However, such third parties may only use personal data for the purposes disclosed in this document, and may not use it for any other purpose.

Some of these Personal Data are stored in a database and file system located in our company premises and/or online facilities. Both database and file systems are controlled by our authorized administrative personnel and can be only accessed by authorized personnel. Rockwell has organizational or administrative, physical, and technical controls and security measures in place ensuring the confidentiality, integrity, and availability of the information contained in the database and file system and all measures are reviewed over time and upgraded in line with technological developments. All other Personal Data are kept in the secured records of Rockwell’s Human Resources Team.

The Personal Data you provide will be retained by Rockwell for a period of ten (10) years from the end date of your assignment, or as long as necessary for a legitimate business purpose (the "Personal Data Retention Period"). While in custody of your Personal Data, Rockwell implements security measures to ensure protection and privacy of your Personal Data. Unless retention for a longer period is required for reasonable cause, the Personal Data shall, upon the lapse of the Personal Data Retention Period, be securely disposed of by Rockwell in accordance with law. You and your professional references are entitled to certain rights in relation to the Personal Data that may be collected from you and from your contacts, including the right to access, correct, and object to the processing, as well as the right to file a complaint before the National Privacy Commission in case of violation of your or your professional reference's rights as data subjects. You may consult Rockwell's Data Protection Officer (DPO) at [email protected] for any concerns regarding your Personal Data.